MALICIOUS — 0ebc1f_46ab4e957ae24687a1f199b914ff43ae.pdf

MALICIOUS — 0ebc1f_46ab4e957ae24687a1f199b914ff43ae.pdf is a pdf sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (96/100). 5 of 50 detection engines flagged it, exhibiting 1 ATT&CK technique.

Identification

SHA-256: 6c45fa7f05328bbe294d1a1381cd283def3fc22e333d1efb96f745e6bfbdc307
SHA-1: bd91d18ccc2c4315efe1971c7e5b88cbe0492c53
MD5: 770a149745c090093f9f3b087fb31462
ssdeep: 1536:Q8d3kg2lpZn8SKSx5DXoqjJwzSfBALmLAPKWr96RrTd8QL35dTh:tt9YnHj5DX0zJiWr96RrX35P
TLSH: T15037D0F7B257DD8C7AC60723AAAF155CA0DAD6887132E761040C775DC8BC9AE3E14902
Submitted as: 0ebc1f_46ab4e957ae24687a1f199b914ff43ae.pdf
File type: pdf · Size: 72368 bytes
Verdict: malicious (96/100)

Detections (5 of 50 engines)

MalwareAnalyser heuristics (entropy/packer): high-entropy-blob
ClamAV (daily): Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0
Emsisoft (Emergency Kit): PDF.Spam.Heur.1
Trellix Stinger (McAfee): PDF/Phish-FAB!770A149745C0
Kaspersky (KVRT): HEUR:Trojan.Script.Generic

MITRE ATT&CK

T1566.002

Why this verdict

The malicious score of 96/100 is the fusion of 5 weighted signals:

ClamAV (daily) flagged Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0 (rule Pdf.Phishing.Trojan-d2568dad23a94d95-d2568dad23a94d95-10044375-0) - engine signal, weight 0.90, confidence 0.95
Embedded link rated malicious by URL analysis: https://static.s123-cdn-static.com/uploads/4443819/normal_5fc8df66b23bc.pdf - network signal, weight 0.70, confidence 0.80
Embedded network infrastructure: https://crophysi.ru/wix?keyword=green+cockroach+dream, http://mpvideo.org/black_and_decker_bread_maker_recipes_b2200twtyz.pdf, http://acgmgroup.ru/jilibufivoxeluzijalyxmgt.pdf - static signal, weight 0.35, confidence 0.60
Document active content: uri-action - static signal, weight 0.30, confidence 0.60
Packing/obfuscation: high-entropy-blob - static signal, weight 0.25, confidence 0.55

Dynamic analysis

No runtime behaviour was captured for this sample, so the analysis above is static only. That is a limit of this run rather than evidence the sample does nothing.

Embedded URLs

https://crophysi.ru/wix?keyword=green+cockroach+dream
http://mpvideo.org/black_and_decker_bread_maker_recipes_b2200twtyz.pdf
https://s3.amazonaws.com/migivewuwe/star_wars_cello_solo_sheet_music.pdf
http://acgmgroup.ru/jilibufivoxeluzijalyxmgt.pdf
https://static.s123-cdn-static.com/uploads/4443819/normal_5fc8df66b23bc.pdf
https://s3.amazonaws.com/widiku/bishop_school_pune_admission_form_2019-_20.pdf
https://static.s123-cdn-static.com/uploads/4485296/normal_5fdf62738a78b.pdf
http://kopivenegi.epizy.com/axis_camera_station_5_user_manual.pdf
https://static.s123-cdn-static.com/uploads/4490123/normal_6002b78940f7e.pdf
https://ginubeputugexow.weebly.com/uploads/1/3/0/7/130738710/sojanopenurege.pdf
http://yogait.space/35635335243ews27.pdf
https://duwiwobejul.weebly.com/uploads/1/3/2/7/132740292/sanuralapavevo-tibitago.pdf
https://cdn-cms.f-static.net/uploads/4450160/normal_60185ecb3950e.pdf
http://priz24.site/83677801894g2agq.pdf
https://cdn-cms.f-static.net/uploads/4455196/normal_6030955ab3c39.pdf
https://refanoripusegu.weebly.com/uploads/1/3/4/3/134306014/sojovegonominekub.pdf
http://how2clever.com/butapitevupyfy0.pdf
http://austritkfa.com/gigusefedepigesolesnnl8.pdf
https://s3.amazonaws.com/tokatefozude/multiplayer_platform_games_ps4.pdf
http://voruluju.epizy.com/cavity_sliding_door_bottom_guides.pdf
http://www.w3.org/1999/02/22-rdf-syntax-ns#
http://purl.org/dc/elements/1.1/
http://ns.adobe.com/pdf/1.3/
http://ns.adobe.com/xap/1.0/
http://ns.adobe.com/xap/1.0/mm/

Embedded domains

crophysi.ru
mpvideo.org
s3.amazonaws.com
acgmgroup.ru
static.s123-cdn-static.com
kopivenegi.epizy.com
ginubeputugexow.weebly.com
yogait.space
duwiwobejul.weebly.com
cdn-cms.f-static.net
priz24.site
refanoripusegu.weebly.com
how2clever.com
austritkfa.com
voruluju.epizy.com
www.w3.org
purl.org
ns.adobe.com

Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report